h1-ctf: [h1-415 2020] Multiple chained vulnerabilities lead to leaking secret document

Hi! Summary Multiple chained vulnerabilities lead to leaking secret documents. Improper sanitization in registration allows an attacker to create a QR recover code for any email address. This leads to an account takeover. Using that technique on jobert's account, attacker can access the support...

h1-ctf: [h1-415 2020] My writeup on how to retrieve the special secret document

Summary: An attacker without any privilege is able to retrieve the special secret document, hosted on the https://h1-415.h1ctf.com website. To do so, multiple steps are required : 1. The authentication must be bypassed to have a licensed account; 2. The support team portal is vulnerable to a blin...

XSpear v1.3 - Powerfull XSS Scanning And Parameter Analysis Tool

XSpear is XSS Scanner on ruby gems Key features Pattern matching based XSS scanning Detect alert confirm prompt event on headless browser with Selenium Testing request/response for XSS protection bypass and reflectedor all params Reflected Params All paramsfor blind xss, anytings Filtered test...

Mail.ru: Blind XSS Stored On Admin Panel Through Name Parameter In [ https://technoatom.mail.ru/]

Blind XSS via username in admin panel of technoatom.mail.ru...

CVE-2019-19742

On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field...

Cross site scripting

On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field...

CVE-2019-19742

CVE-2019-19742 affects D-Link DIR-615 routers, where the User Account Configuration page is vulnerable to blind XSS via the name field. Connected sources substantiate a lack of proper input validation on the web UI leading to client-side script execution; exploitation steps reported include inser...

CVE-2019-19742

On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field...

Mail.ru: [panel.city-mobil.ru/admin/] Blind XSS into username

Blind XSS in admin/support panel of city-mobil.ru via partner superuser's name different from 746497...

Mail.ru: [https://city-mobil.ru/taxiserv] Blind XSS into username

Blind XSS in admin/support panel of city-mobil.ru via partner superuser's name...

Zomato: [www.zomato.com] Blind XSS on one of the Admin Dashboard

Thanks for the report @pandaaaa. The Blind XSS fired when the order details were viewed by the admin at the back-end, The script was injected through an API endpoint from the Zomato app on one of the parameters which was recently introduced to provide special instructions to the restaurant on how...

B-XSSRF - Toolkit To Detect And Keep Track On Blind XSS, XXE And SSRF

Toolkit to detect and keep track on Blind XSS, XXE & SSRF. SETUP Upload the files to your server. Create a Database and upload database.sql file to it. Change the DB Credentials in db.php file. Ready. USAGE BLIND XSS BLIND XXE %ext; SSRF GET /testssrf.php=http://mysite.com/bxssrf/request.php...

Acronis: Blind XSS on admin.acronis.com via delete account form on account.acronis.com

Blind XSS vulnerability was discovered on admin.acronis.com. The vulnerability could be triggered by sending a payload during the account deletion process on account.acronis.com...

Mail.ru: Blind XSS in operator's interface for 33slona.ru

Blind stored XSS in operator's interface of 33slona.ru via call back request...

Pornhub: Blind XSS in redtube administering site my.reflected.net

Researcher was able to execute Blind XSS in Redtube WAF administering panel Blind XSS in Redtube WAF administering panel...

Nextcloud: Blind Stored XSS on iOS App due to Unsanitized Webview

Hi Team! I found a Blind XSS can executed on iOS App due to unsanitized webview. Using this issue, attacker can extract information from victim. Steps To Reproduce: 1. Upload malicious HTML, share to victim 2. Waiting victim to open it F487447 F487448 HTML payload attached, don't forget to change...

UPDATE: XSStrike 3.1.2

PenTestIT RSS Feed My initial post about this advanced XSS detection and exploitation suite was almost an year ago! Three days ago, an update - XSStrike 3.1.2 was released. This is a post that documents these changes. What is XSStrike? XSStrike is a Cross Site Scripting detection suite equipped...

Uber: [manage.jumpbikes.com] Blind XSS on Jump admin panel via user name

By setting a user's name to an XSS payload, a user was able to inject JavaScript which was executed on the administrative panel for Jump bikes, allowing complete compromise of the panel, exposing user activity, personal information and billing information...

Zomato: [www.zomato.com] Blind XSS in one of the Admin Dashboard

@sandeephodkasia identified a Blind XSS vulnerability that fired in one of our admin dashboard. POC - @sandeephodkasia added "alert0; XSS Hunter was used in this case in address field while placing an order. - XSS triggered when one of our support agent viewed the order details. Thanks...

Rocket.Chat: Blind XSS in the rocket.chat registration email

Note: This report was initially sent via email and I was invited to submit this here. Hi team, During an audit on a third-party, I discovered that rocket.chat Android client might be vulnerable to blind XSS. My XSS payload fired in the context of the target's rocket.chat client as you can see bel...